Skip to content
fr Sign in
7.9 High

CVE-2025-57820 Svelte devalue is a utility library

Description

Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2

Affected products and versions

Product Affected versions Fixed in
devalue 5.3 earliest → < 5.3.2 5.3.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of devalue

The 7 CVEs of devalue →
CVE-2026-92708 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 7.5 High CVE-2026-81176 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 5.3 Medium CVE-2026-42570 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 7.5 High CVE-2026-30226 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 6.3 Medium
Track this CVE